feat(fast-inbox): single variable-size InboxParity proof per checkpoint (A-1427)

Replaces the parity base (×4) + parity root fan-in with **one variable-size `InboxParity<S>` proof per checkpoint**, S ∈ {64, 256, 1024} (one VK per size; the prover proves the smallest rung ≥ the checkpoint's message count). The parity-root circuit is deleted; the checkpoint root keeps a single parity verification, now accepting the 3-rung VK ladder. Net **+1 VK**.

Stacked on #24612 (`spl/a-1375-msgs-only-block`).

- **`in_hash` unconstrained pass-through.** The circuit no longer builds the sha256 frontier tree. `in_hash` stays in the parity public inputs as an unconstrained hint — the orchestrator supplies the true frontier root via `computeInHashFromL1ToL2Messages`, the circuit echoes it out, and the checkpoint root copies it into the header. L1's `require(header.inHash == inbox.consume())` still passes, so **no L1 changes** (`ConstantsGen.sol` regenerates byte-identical to the base).
- **Sponge real-count decoupling.** Block roots absorb the message sponge at the real count while the L1-to-L2 tree insert stays a padded fixed subtree, via a new `L1ToL2MessageBundle { messages, num_msgs, num_real_msgs }` struct so the real count can be dropped later with minimal change. `num_msgs` is not otherwise pinned in-circuit — documented as a dev-mode gap backstopped by the L1 pending-chain header hash, parallel to `in_hash`.

Threads the single sized proof through the orchestrator, bb-prover, proving broker, and TS bindings — collapsing `getBaseParityProof`/`getRootParityProof` into `getInboxParityProof` and `PARITY_BASE`/`PARITY_ROOT` into one `INBOX_PARITY` request type. The UltraHonk parity benchmark and bb.js debug test move to `InboxParity256`.

- `rollup_lib` nargo suite: 387/387 passing.
- Reviewed by a second model (Fable) and codex sol; their build-break and consistency findings are folded in.
- Full `yarn build`, VK/artifact regen, real proofs, and e2e run in CI (blocked locally by a `bb write_vk` memory-arena OOM on the unchanged `rollup_root` circuit).

`inbox_rolling_hash.nr`'s doc comment claims the sha256 chain "matches the L1 Inbox," but `Inbox.sol` accumulates `bytes16(keccak256(...))`. Harmless today (the rolling hash isn't validated on L1), but the comment should be corrected on the base branch.

The oldest-epoch-first proving-broker scheduling fix that previously headed this branch has been moved down to #24603 (A-1374), where it is required to keep `long_proving_time` green on the intermediate stack. The stack top is unchanged — only the commit's position changed.

Replaces #24759.

Author: spalladino

noir-projects/fnd/noir-protocol-circuits/Nargo.template.toml

@@ -8,8 +8,9 @@ members = [
     "crates/types",
     "crates/protocol-test-utils",
     "crates/blob",
-    "crates/parity-base",
-    "crates/parity-root",
+    "crates/inbox-parity-64",
+    "crates/inbox-parity-256",
+    "crates/inbox-parity-1024",
     "crates/private-kernel-lib",
     "crates/private-kernel-init",
     "crates/private-kernel-init-2",

noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-1024/Nargo.toml

@@ -0,0 +1,8 @@
+[package]
+name = "inbox_parity_1024"
+type = "bin"
+authors = [""]
+compiler_version = ">=0.18.0"
+
+[dependencies]
+rollup_lib = { path = "../rollup-lib" }

noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-1024/src/main.nr

@@ -0,0 +1,5 @@
+use rollup_lib::parity::{inbox_parity, InboxParityPrivateInputs, ParityPublicInputs};
+
+fn main(inputs: InboxParityPrivateInputs<1024>) -> pub ParityPublicInputs {
+    inbox_parity::execute(inputs)
+}

…l-circuits/crates/parity-root/Nargo.toml …cuits/crates/inbox-parity-256/Nargo.tomlnoir-projects/fnd/noir-protocol-circuits/crates/parity-root/Nargo.toml renamed to noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-256/Nargo.toml noir-projects/fnd/noir-protocol-circuits/crates/parity-root/Nargo.toml renamed to noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-256/Nargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "parity_root"
+name = "inbox_parity_256"
 type = "bin"
 authors = [""]
 compiler_version = ">=0.18.0"

noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-256/src/main.nr

@@ -0,0 +1,5 @@
+use rollup_lib::parity::{inbox_parity, InboxParityPrivateInputs, ParityPublicInputs};
+
+fn main(inputs: InboxParityPrivateInputs<256>) -> pub ParityPublicInputs {
+    inbox_parity::execute(inputs)
+}

…l-circuits/crates/parity-base/Nargo.toml …rcuits/crates/inbox-parity-64/Nargo.tomlnoir-projects/fnd/noir-protocol-circuits/crates/parity-base/Nargo.toml renamed to noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-64/Nargo.toml noir-projects/fnd/noir-protocol-circuits/crates/parity-base/Nargo.toml renamed to noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-64/Nargo.toml

@@ -1,5 +1,5 @@
 [package]
-name = "parity_base"
+name = "inbox_parity_64"
 type = "bin"
 authors = [""]
 compiler_version = ">=0.18.0"

noir-projects/fnd/noir-protocol-circuits/crates/inbox-parity-64/src/main.nr

@@ -0,0 +1,5 @@
+use rollup_lib::parity::{inbox_parity, InboxParityPrivateInputs, ParityPublicInputs};
+
+fn main(inputs: InboxParityPrivateInputs<64>) -> pub ParityPublicInputs {
+    inbox_parity::execute(inputs)
+}

noir-projects/fnd/noir-protocol-circuits/crates/parity-base/src/main.nr

@@ -2,8 +2,9 @@ use crate::utils::pad_end;
 use types::{
     constants::{
         BLOCK_ROOT_MSGS_ONLY_ROLLUP_VK_INDEX, HIDING_KERNEL_TO_PUBLIC_VK_INDEX,
-        MEGA_KERNEL_VK_LENGTH_IN_FIELDS, PARITY_BASE_VK_INDEX, PARITY_ROOT_VK_INDEX,
-        PRIVATE_KERNEL_INIT_2_VK_INDEX, PRIVATE_KERNEL_INIT_3_VK_INDEX,
+        INBOX_PARITY_1024_VK_INDEX, INBOX_PARITY_256_VK_INDEX, INBOX_PARITY_64_VK_INDEX,
+        MEGA_KERNEL_VK_LENGTH_IN_FIELDS, PRIVATE_KERNEL_INIT_2_VK_INDEX,
+        PRIVATE_KERNEL_INIT_3_VK_INDEX,
         PRIVATE_KERNEL_INIT_4_VK_INDEX, PRIVATE_KERNEL_INIT_5_VK_INDEX,
         PRIVATE_KERNEL_INNER_2_VK_INDEX, PRIVATE_KERNEL_INNER_3_VK_INDEX,
         PRIVATE_KERNEL_INNER_4_VK_INDEX, PRIVATE_KERNEL_INNER_5_VK_INDEX,
@@ -80,9 +81,12 @@ pub global VK_MERKLE_TREE: MerkleTree<VK_TREE_WIDTH> = {
     }
 
     // Honk
-    // Override some of the above with Honk Vks.
-    leaves[PARITY_BASE_VK_INDEX] = generate_fake_honk_vk_for_index(PARITY_BASE_VK_INDEX).hash;
-    leaves[PARITY_ROOT_VK_INDEX] = generate_fake_honk_vk_for_index(PARITY_ROOT_VK_INDEX).hash;
+    // The inbox parity ladder circuits are plain UltraHonk (not rollup-honk) and live past the reset range.
+    leaves[INBOX_PARITY_64_VK_INDEX] = generate_fake_honk_vk_for_index(INBOX_PARITY_64_VK_INDEX).hash;
+    leaves[INBOX_PARITY_256_VK_INDEX] =
+        generate_fake_honk_vk_for_index(INBOX_PARITY_256_VK_INDEX).hash;
+    leaves[INBOX_PARITY_1024_VK_INDEX] =
+        generate_fake_honk_vk_for_index(INBOX_PARITY_1024_VK_INDEX).hash;
     leaves[ROOT_ROLLUP_VK_INDEX] = generate_fake_honk_vk_for_index(ROOT_ROLLUP_VK_INDEX).hash;
 
     MerkleTree::new(leaves)